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Gy HONG KONG MONETARY AUTHORITY 


31 March 2011 


The Chief Executive 
All Authorized Institutions 


Dear Sir/Madam, 


Implementation of Positive Mortgage Data Sharing (“PMDS”) 


I am writing to set out steps that authorized institutions (“Als”) will need to take 
forthwith to implement PMDS as this will enhance their credit risk management 
capability and thereby promoting banking and financial stability in Hong Kong. In 
this connection, the Office of the Privacy Commissioner for Personal Data (“PCO”) 
conducted a public consultation in 2011 on proposed revisions to the Code of Practice 
on Consumer Credit Data (the “Code”). The Code will be revised on 1 April 2011 
based on the PCO’s determinations as set out in his public consultation conclusions 
report of 21 March 2011. Iam pleased to note that the PCO has determined that the 
industry’s proposal for PMDS will lead to responsible borrowing and lending, and the 
Code will be revised to allow for the implementation of PMDS. We understand that 
the revised Code will be available at the PCO’s website at www.pcpd.org.hk on 
1 April 2011. Als should study details of the revised Code carefully. 


There were six privacy issues raised in the 2011 public consultation document and in 
relation to Issue 3 the PCO is of the view that the uploading of pre-existing mortgage 
data to the Credit Reference Agency (“CRA”) requires the prescribed consent’ of the 
customer. A summary of the Privacy Commissioner’s views and conclusions is set 
out in the Annex. Als involved in the provision of mortgage loans should, with 
effect from 1 April 2011, share and use positive mortgage data through the CRA 
within the framework laid down in the revised Code. For the purpose of setting up a 
comprehensive database by the CRA and to comply with the PCO’s requirement, AIs 
are required to comply with the following requirements in relation to pre-existing 
mortgage data? and new mortgage loan applications: 


(1) Pre-existing Mortgage Data 


1 
2 


“Prescribed consent” means express consent voluntarily given. 
Pre-existing mortgage data refers to the mortgage account general data of any account relating to a 
mortgage loan which already existed prior to 1 April 2011 and continues to exist after that date. 
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With a view to building up a comprehensive mortgage loan database, Als are 
required to issue consent seeking forms from 1 April 2011 onwards to seek the 
prescribed consent of existing mortgage customers (i.e. borrowers, mortgagors 
or guarantors) for the uploading of their pre-existing mortgage data to the CRA. 
The Hong Kong Association of Banks (“HKAB”) has drawn up a sample 
consent wording (copy circulated by the industry associations to their members) 
that was prepared by its external legal adviser and incorporates the comments of 
the PCO and the HKMA. Als should adopt the sample consent wording as far 
as possible. 


(2) New Mortgage Loan Applications 


The HKMA expects Als to make full use of the PMDS arrangements as set out 
in this circular, and through the CRA database to verify the information declared 
by mortgage applicants in respect of their pre-existing mortgage loans, thus 
deterring such applicants from providing false information. Accordingly, Als 
should review their current policies, procedures and practice with regard to their 
mortgage loan lending business to ensure that they comply with the 
requirements of the revised Code. 


Need for Prescribed Consent 


As the uploading of pre-existing mortgage data requires the prescribed consent of 
existing mortgage customers, the PMDS database at the CRA will take considerable 
time to build up. To address this shortcoming, the HKMA has agreed with the 
banking industry that declarations made by mortgage loan applicants about their 
pre-existing mortgages when they apply for new mortgages need to be verified. To 
do this, Als need to obtain a comprehensive “all in one” prescribed consent from a 
customer when he/she applies for a new mortgage loan as set out in the sample 
consent wording circulated by the HKAB and other relevant industry associations. 
Als should explain to the mortgage applicants that the prescribed consent will be 
addressed to all credit providers which are members of the CRA (“Members”) and to 
the CRA. After the consent has been received, it will be passed to the CRA which 
will then check with all the Members to verify if the customer has any mortgage loan 
with any of them. The CRA will upload any mortgage account general data of the 
customer it receives to its database, compile the mortgage count of that customer, and 
then report the mortgage count back to the mortgage loan processing AI. 


Where Prescribed Consent is Provided 





Where a customer’s prescribed consent is obtained, Als should review the 
pre-existing “mortgage count” of the mortgage loan applicant through conducting a 
search with the CRA and conducting follow up enquiry during the loan approval 
process to verify the accuracy of mortgage loan-related information provided in 
his/her declaration. Als should establish clear policies on how to follow-up with the 
mortgage loan applicant where there are differences between the applicant’s “declared 


mortgage count” and the “actual mortgage count” obtained from the CRA especially 
if the latter is larger than the former. Should this happen, an AI should seek 
clarification from the customer and reject the mortgage loan application unless the 
customer can provide a satisfactory explanation for the discrepancy in the mortgage 
count. 


Where Prescribed Consent is not Provided 


Where the customer’s prescribed consent is not obtained, the AI may still continue to 
process the mortgage loan application. However, the AI should consider other 
compensating arrangements such as requesting the mortgage applicant to provide 
statements of bank accounts maintained with other banks with whom the applicant has 
existing mortgage(s) to assess the applicant’s repayment ability. Also, Als should 
carefully consider other factors including but not limited to his/her net worth, his/her 
disposable income, the value of the collateral and any other relevant information that 
may be available to Als when assessing the loan application. After the AI has 
exhausted all available channels but is still unable to be satisfied with the credit 
worthiness of the applicant, it may either refuse the application or apply more prudent 
underwriting standards in respect of the mortgage loan application. For instance, a 
lower loan-to-value ratio may need to be set at no less than ten percentage points of 
the requirements as prescribed by the HKMA from time to time or the amount applied 
for, whichever is lower and/or a higher interest pricing of no less than one percentage 
point above the normal mortgage loan interest pricing. In addition, the 
debt-servicing ratio (“DSR”) and the stress DSR have to be calculated on the basis of 
the higher interest rate applied on the mortgage loan offered to the customer. Should 
Als deviate from applying the above requirements, they should be prepared to provide 
robust justifications in due course when required by the HKMA. The HKMA will 
take a serious view of Als that are considered to be intentionally circumventing these 
requirements. For customers who entered the provisional agreement for sale and 
purchase before 1 April 2011, Als are not expected to implement the above measures 
in relation to their relevant mortgage applications. 


Transitional Arrangement 


While the HKMA expects Als to give priority to the IT system development work that 
is required to fully automate the process for verifying customer declarations as soon 
as practicable, the full automation will take time to complete. As a transitional 
arrangement, the HKMA will require the banking industry to conduct daily manual 
sample checking to verify mortgage loan applicants’ declaration of their existing 
mortgages when they apply for new mortgage loans from 1 April 2011 with the 
assistance of the CRA until the process can be fully automated. 


Detailed guidance and the sample checking procedures will be disseminated through 
the CRA. Als are required to comply with such procedures. Following manual 
sample checking by sample receiving Als, the sample provider AI will receive the 
mortgage count of those applicants who are selected for the sample checking from the 


CRA. The sample provider Als should make use of the mortgage count information 
provided by the CRA to verify the information declared by the customers. If a false 
declaration is identified, the AI should consider taking appropriate actions (including 
seeking additional information or clarification from the customer as appropriate to 
adequately manage its credit risk and consider taking legal proceedings in appropriate 
cases as per our circular of 13 August 2010). 


Lines of Actions 





To ensure that the benefits of PMDS can be achieved as soon as possible, Als should 
pay particular attention and accord a high priority to the following lines of actions: 


(i) adopt the sample consent wording provided by the HKAB or prepare their 
own consent wording if considered necessary; 


(ii) adopt the sample supplemental Personal Information Collection Statement 
(“PICS”) for mortgage loans provided by the HKAB or prepare their own 
supplemental PICS to meet the requirements of Clause 2.1A of the revised 
Code and amend the existing PICS to reflect other amendments of the 
Code; 


(iii) properly brief frontline staff in order to advise them how to obtain customer 
consent and respond to customer enquiries; 


(iv) arrange for dispatch of the consent seeking forms for new mortgage loan 
applications to the branches or other mortgage business distribution 
channels of Als as soon as possible; and 


(v) review and revise the policies and procedures to cater for the PMDS 
arrangements as set out in this circular as soon as practicable. 


Als are expected to take steps to comply with the revised Code and seek the 
prescribed consent to implement the PMDS proposal set out in this circular. The 
revised policies, procedures and practice of Als should be covered in the annual 
compliance audit specified under section 4.7 of the Supervisory Policy Manual 
module IC-6 “The Sharing and Use of Consumer Credit Data through a Credit 
Reference Agency” (“SPM IC-6”). To ensure a level playing field and the 
comprehensiveness of the CRA database, the HKMA will, as and when appropriate, 
monitor through regular surveys and enquiries to ensure that Als are not selectively 
seeking prescribed consent from customers, and to collect statistics on the prescribed 
customer consent received by Als. 


The HKMA will revise SPM IC-6 to cater for the revised regime in the sharing and 
use of positive mortgage data through a CRA as soon as practicable. As in the past, 
the HKMA will seek the industry associations’ comments on the proposed 
amendments to SPM IC-6 in due course. 


If you have any questions on this matter, please contact Mr Steve Lau at Tel 2878 
1595. 


Yours faithfully, 


Meena Datwani 
Executive Director (Banking Conduct) 


Encl 


Annex 


Summary of the Privacy Commissioner’s determinations on the six privacy issues raised 
in the 2011 consultation document. 


Privacy Issue 1 


The issue is whether the sharing of the Additional Mortgage Data (i.e. positive mortgage data 
for residential properties as well as both positive and negative data for non-residential 
properties) is necessary and not excessive for the purpose of credit risk assessment. The Privacy 
Commissioner has concluded in the affirmative. 


Privacy Issue 2 





The issue is whether the items of mortgage data proposed to be shared between the CRA and 
the credit providers are not excessive for the latter’s credit assessment purposes. The Privacy 
Commissioner accepts that they are not excessive except that ‘gender’ could be deleted from 
the data collection list as it contributes only marginal enhancement to the reliability of customer 
identification by the CRA. 


Privacy Issue 3 





The issue is whether it is appropriate for the Additional Mortgage Data in respect of 
pre-existing mortgages at the time of the implementation of the proposal to be contributed by 
the credit providers to the CRA, with or without prior explicit notification to the consumers. 
The Privacy Commissioner supports the Industry proposal of sharing pre-existing mortgage 
data for negative mortgage data but not for positive mortgage data unless prescribed consent is 
obtained from the consumers. 


Privacy Issue 4 


The issue is whether it is appropriate to permit, subject to the consumers’ written consent, 
access to the Additional Mortgage Data by the credit providers to evaluate not only mortgage 
loan applications but also to assess other new consumer credit applications as well as review 
and renewal of the consumers’ existing credit facilities. 


The Privacy Commissioner has concluded that sharing of mortgage data for credit assessment 
of non-mortgage related credit facilities, irrespective of the amount of the credit, would be 
excessive in the case of positive data but not excessive in the case of negative data. He 
considers that a threshold amount of the credit facility involved should be set under which no 
access to positive mortgage data by the credit provider should be allowed. Pending the 
Industry’s submission of such a threshold to the satisfaction of HKMA and PCPD, he would 
restrict the sharing of positive mortgage data to mortgage loan application and review of 
existing mortgage loans only. 


Privacy Issue 5 





The Industry proposal is to incorporate a 24-month transitional period before access to the 
Additional Mortgage Data is allowed for general portfolio reviews of consumers’ 


credit-worthiness. The Privacy Commissioner is pleased to accept the proposal. 


Privacy Issue 6 





The issue is what and how additional privacy safeguards should be imposed upon the CRA and 
the credit providers consequent to an enlarged credit database and greater sharing and use of the 
mortgage data. 


The Privacy Commissioner notes that the consultation exercise has aroused the community’s 
interest in the existing system of sharing of consumer credit data between the CRA and the 
credit providers. People are generally concerned about whether the CRA is measuring up to 
their expectations. The consensus view collected supports the Privacy Commissioner’s 
suggestions that additional privacy safeguards should be imposed upon the CRA consequent to 
the proposed enlarged credit database and greater sharing of the mortgage data. Accordingly, 
the Privacy Commissioner will revise the Code to incorporate additional post-implementation 
safeguards. 


